Should I remove “Trojan.ConvagentPMF.S26551979”?

The Trojan.ConvagentPMF.S26551979 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.ConvagentPMF.S26551979 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Presents an Authenticode digital signature
• Creates RWX memory
• Dynamic (imported) function loading detected
• Enumerates the modules from a process (may be used to locate base addresses in process injection)
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Xhosa
• Authenticode signature is invalid
• CAPE detected the RedLine malware family
• Anomalous binary characteristics

How to determine Trojan.ConvagentPMF.S26551979?

File Info:
name: 4931BD4028F7C6A05811.mlw
path: /opt/CAPEv2/storage/binaries/9fb423eba76f616891ca4f715de9382ed2410b2a01af082cc8f69e5798a8e174
crc32: 5FF898C2
md5: 4931bd4028f7c6a05811459ca8775655
sha1: 81d90a71b8354cd975050b048e62efca47068df5
sha256: 9fb423eba76f616891ca4f715de9382ed2410b2a01af082cc8f69e5798a8e174
sha512: d0eb12607c7413b5946704349a64d6ccdd3d68e35be50c92da0cf53cfa9600fcef0f734a4d1d6916ce73857f2933ec6328eb32814ff04176e12f27e93da93464
ssdeep: 6144:Ngt27jJAPM/i2XQ5pV6FYbkOOlVRNFuESEMxVJigaGfga:U27jKPMm8FhOOlnNFfoe+f3
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T16994F0123A90D432C8828D7098B5DBF14A7BF8B24D64954BF754BB6F6E317E1363630A
sha3_384: 575d6cb8d2006cbd707d92076608b83eb5c7eb6f40a19cfce899098ce0575274cbc1f81c1b29337a6d5680fc69c34922
ep_bytes: e825600000e978feffff8bff558bec8b
timestamp: 2021-01-12 04:15:16

Version Info:
FileVersion: 21.79.11.69
InternationalName: pomgveoci.iwe
Copyright: Copyrighz (C) 2021, fudkorta
Translations: 0x0127 0x010f

Trojan.ConvagentPMF.S26551979 also known as:

How to remove Trojan.ConvagentPMF.S26551979?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.